Category: A02: Security Misconfiguration
Identify exposed configuration files, unnecessary data exposure, and weak security hardening issues commonly found in misconfigured production environments.
Multiple configuration weaknesses were identified through directory enumeration, API inspection, and response analysis.
The /ftp directory was publicly accessible and contained development artifacts,
backup files, and operational data including backup archives and encrypted materials.
Accessing internal resources triggered verbose stack traces exposing backend file paths, routing logic, and technology stack details.
The address endpoint exposed personally identifiable information including full name, phone number, and physical address mapped to numeric identifiers.
Critical browser protections such as Content Security Policy (CSP), HSTS, and Referrer Policy were absent, weakening client-side defenses.
Response headers exposed undocumented routes such as
X-Recruiting: /#/jobs, revealing internal functionality.
Security misconfigurations often appear minor individually but can collectively lead to significant exposure of sensitive data and internal architecture. Proper production hardening is critical to reducing attack surface.
This lab highlights how overlooked configuration issues can expose valuable reconnaissance data to attackers. Many real-world breaches originate from simple deployment oversights rather than complex exploits.